What is the difference between authentication and authorization?
Authentication determines who a user or client is. Authorization determines what that authenticated identity is allowed to do. For example, logging in with valid credentials is authentication, while checking whether that user has permission to delete another user's account is authorization.
Key Takeaways
- Authentication answers who are you?
- Authorization answers what are you allowed to do?
- Authorization should be enforced server-side.
Knowledge Check
Which statement correctly describes authorization?